# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Symlink following in Lenovo Dock Manager](https://agentprime.io/advisories/CVE-2026-63426.md)
  `CVE-2026-63426` · CVE record: Lenovo Dock Manager · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [Symlink following in Lenovo Vantage](https://agentprime.io/advisories/CVE-2026-12036.md)
  `CVE-2026-12036` · CVE record: Lenovo Vantage · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink](https://agentprime.io/advisories/CVE-2026-70460.md)
  `CVE-2026-70460` · CVE record: RsyncProject rsync · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync < 3.5.0 Symlink Race Condition Directory Traversal](https://agentprime.io/advisories/CVE-2026-53801.md)
  `CVE-2026-53801` · CVE record: RsyncProject rsync · CVSS 8.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Race condition
- [rsync < 3.5.0 Symlink Race Condition via --remove-source-files](https://agentprime.io/advisories/CVE-2026-53800.md)
  `CVE-2026-53800` · CVE record: RsyncProject rsync · CVSS 5.7 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Race condition
- [rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application](https://agentprime.io/advisories/CVE-2026-53799.md)
  `CVE-2026-53799` · CVE record: RsyncProject rsync · CVSS 7.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Race condition
- [rsync < 3.5.0 Symlink Race Condition Information Disclosure](https://agentprime.io/advisories/CVE-2026-53797.md)
  `CVE-2026-53797` · CVE record: RsyncProject rsync · CVSS 5.7 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Race condition
- [rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling](https://agentprime.io/advisories/CVE-2026-53796.md)
  `CVE-2026-53796` · CVE record: RsyncProject rsync · CVSS 5.8 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Race condition
- [rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest](https://agentprime.io/advisories/CVE-2026-53795.md)
  `CVE-2026-53795` · CVE record: RsyncProject rsync · CVSS 7.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode](https://agentprime.io/advisories/CVE-2026-53793.md)
  `CVE-2026-53793` · CVE record: RsyncProject rsync · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync < 3.5.0 Path Traversal Write Escape via --relative Mode](https://agentprime.io/advisories/CVE-2026-53785.md)
  `CVE-2026-53785` · CVE record: RsyncProject rsync · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync < 3.5.0 Path Traversal via Symlink Module Root](https://agentprime.io/advisories/CVE-2026-53784.md)
  `CVE-2026-53784` · CVE record: RsyncProject rsync · CVSS 8.4 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync](https://agentprime.io/advisories/CVE-2026-53783.md)
  `CVE-2026-53783` · CVE record: RsyncProject rsync · CVSS 8.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Command injection
- [rsync < 3.5.0 Symlink Following Arbitrary File Overwrite](https://agentprime.io/advisories/CVE-2026-53803.md)
  `CVE-2026-53803` · CVE record: RsyncProject rsync · CVSS 8.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read](https://agentprime.io/advisories/GHSA-rm43-82j9-r4mj.md)
  `GHSA-rm43-82j9-r4mj`, `CVE-2026-91989` · PyPI `atomic-agents-stack`: affected `<1.1.0`, fixed in `1.1.0` · CVSS 8.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite](https://agentprime.io/advisories/GHSA-2jwf-f4xq-f24h.md)
  `GHSA-2jwf-f4xq-f24h`, `CVE-2026-55086` · npm `ep_etherpad-lite`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 4.2 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, CWE-377
- [WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability](https://agentprime.io/advisories/CVE-2026-65582.md)
  `CVE-2026-65582` · CVE record: LiquidThemes AI Hub · CVSS 7.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability](https://agentprime.io/advisories/CVE-2026-61980.md)
  `CVE-2026-61980` · CVE record: Daan.dev OMGF Pro · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-28189.md)
  `CVE-2026-28189` · CVE record: Roland Barker Participants Database · CVSS 7.4 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability](https://agentprime.io/advisories/CVE-2026-28157.md)
  `CVE-2026-28157` · CVE record: Lasso Analytics, Inc. Do Lasso · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink](https://agentprime.io/advisories/CVE-2026-73613.md)
  `CVE-2026-73613` · CVE record: filebrowser filebrowser · CVSS 7.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [Prisma Access Agent: Authenticated Limited File Deletion on Linux](https://agentprime.io/advisories/CVE-2026-0291.md)
  `CVE-2026-0291` · CVE record: Palo Alto Networks Prisma Access Agent · CVSS 1.1 Low · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)](https://agentprime.io/advisories/GHSA-cxgv-hp74-jj7r.md)
  `GHSA-cxgv-hp74-jj7r`, `CVE-2026-55074`, `PYSEC-2026-3658` · PyPI `ansible-jailexec`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 8.2 High · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in \_style_tag_for](https://agentprime.io/advisories/CVE-2026-17431.md)
  `CVE-2026-17431` · CVE record: MITHALDU PDF::WebKit · CVSS 6.1 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal, Command injection
- [Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host](https://agentprime.io/advisories/CVE-2026-13622.md)
  `CVE-2026-13622` · CVE record: Red Hat Red Hat Container Native Virtualization 4.12 and 4 more · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [rConfig < 8.2.13 Path Traversal File Read via FileDownloadController](https://agentprime.io/advisories/CVE-2026-64826.md)
  `CVE-2026-64826` · CVE record: rConfig rConfig · CVSS 7.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-13105.md)
  `CVE-2026-13105` · CVE record: IBM i Access Client Solutions · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Arbitrary file read+write on host via templates/ symlink in malicious image](https://agentprime.io/advisories/CVE-2026-16033.md)
  `CVE-2026-16033` · CVE record: Canonical LXD · CVSS 8.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE](https://agentprime.io/advisories/CVE-2026-66898.md)
  `CVE-2026-66898` · CVE record: Canonical LXD · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root](https://agentprime.io/advisories/CVE-2026-63293.md)
  `CVE-2026-63293` · CVE record: Canonical LXD · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Root RCE via image backup.yaml symlink](https://agentprime.io/advisories/CVE-2026-63294.md)
  `CVE-2026-63294` · CVE record: Canonical LXD · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access](https://agentprime.io/advisories/GHSA-w62w-66v9-vvgv.md)
  `GHSA-w62w-66v9-vvgv`, `BIT-seaweedfs-2026-54917`, `BIT-seaweedfs-2026-58372`, `CVE-2026-54917`, `CVE-2026-58372`, `GO-2026-6221` · Go `github.com/seaweedfs/seaweedfs`: affected `<0.0.0-20260526080459-dd1b4287899e`, fixed in `0.0.0-20260526080459-dd1b4287899e` · CVSS 7.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [IBM i is Affected By Multiple Vulnerabilities in Navigator for i](https://agentprime.io/advisories/CVE-2026-17266.md)
  `CVE-2026-17266` · CVE record: IBM i · CVSS 6.5 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [IBM i is Affected By Path Traversal Vulnerability in Navigator for i](https://agentprime.io/advisories/CVE-2026-17094.md)
  `CVE-2026-17094` · CVE record: IBM i · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [IBM i is Affected By Multiple Vulnerabilities in Navigator for i](https://agentprime.io/advisories/CVE-2026-18106.md)
  `CVE-2026-18106` · CVE record: IBM i · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.](https://agentprime.io/advisories/CVE-2026-65941.md)
  `CVE-2026-65941` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal, Code injection, Authentication bypass, Server-side request forgery (SSRF)
- [WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.](https://agentprime.io/advisories/CVE-2026-65939.md)
  `CVE-2026-65939` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 6.8 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal, Unrestricted file upload
- [SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames](https://agentprime.io/advisories/GHSA-q939-rpr3-3284.md)
  `GHSA-q939-rpr3-3284`, `CVE-2026-48798` · NuGet `SSH.NET`: affected `<2026.0.0`, fixed in `2026.0.0` · CVSS 7.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Authenticated users may write data outside the intended Docker cache path](https://agentprime.io/advisories/CVE-2026-66384.md)
  `CVE-2026-66384` · CVE record: jfrog artifactory · CVSS 5.3 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Authenticated users may write files outside the intended Artifactory work directory](https://agentprime.io/advisories/CVE-2026-66382.md)
  `CVE-2026-66382` · CVE record: jfrog artifactory · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Repository readers may access content outside configured upstream paths](https://agentprime.io/advisories/CVE-2026-66381.md)
  `CVE-2026-66381` · CVE record: jfrog artifactory · CVSS 5.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag](https://agentprime.io/advisories/CVE-2026-73291.md)
  `CVE-2026-73291` · CVE record: seerr-team seerr · CVSS 7.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal, Code injection
- [Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0](https://agentprime.io/advisories/CVE-2026-67286.md)
  `CVE-2026-67286` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 6.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0](https://agentprime.io/advisories/CVE-2026-67285.md)
  `CVE-2026-67285` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal](https://agentprime.io/advisories/CVE-2026-18048.md)
  `CVE-2026-18048` · CVE record: Unknown WP Photo Album Plus · CVSS 7.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation](https://agentprime.io/advisories/CVE-2026-19594.md)
  `CVE-2026-19594` · CVE record: Snowflake Snowflake Python APIs · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal, CWE-141
- [Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation](https://agentprime.io/advisories/CVE-2026-63134.md)
  `CVE-2026-63134` · CVE record: cisagov Malcolm · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing](https://agentprime.io/advisories/CVE-2026-73244.md)
  `CVE-2026-73244` · CVE record: kekingcn kkFileView · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [FreeCAD: FCStd path traversal allows arbitrary file write via unsanitized file attribute in PropertyFileIncluded::Restore()](https://agentprime.io/advisories/CVE-2026-73234.md)
  `CVE-2026-73234` · CVE record: FreeCAD FreeCAD · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision](https://agentprime.io/advisories/CVE-2026-19091.md)
  `CVE-2026-19091` · CVE record: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · CVSS 8.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field](https://agentprime.io/advisories/CVE-2026-16230.md)
  `CVE-2026-16230` · CVE record: Strategy11 Formidable Digital Signatures · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header](https://agentprime.io/advisories/CVE-2026-73034.md)
  `CVE-2026-73034` · CVE record: eosphoros-ai DB-GPT · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path](https://agentprime.io/advisories/CVE-2026-71475.md)
  `CVE-2026-71475` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing](https://agentprime.io/advisories/CVE-2026-72742.md)
  `CVE-2026-72742` · CVE record: Stanford NLP DSPy · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [electerm's RDP clipboard file download may parse unsafe file name](https://agentprime.io/advisories/CVE-2026-73227.md)
  `CVE-2026-73227` · CVE record: electerm electerm · CVSS 8.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [electerm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filename](https://agentprime.io/advisories/CVE-2026-73225.md)
  `CVE-2026-73225` · CVE record: electerm electerm · CVSS 8.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename](https://agentprime.io/advisories/CVE-2026-73223.md)
  `CVE-2026-73223` · CVE record: electerm electerm · CVSS 8.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [XAgent Path Traversal Arbitrary File Read via /workspace/file](https://agentprime.io/advisories/CVE-2026-72713.md)
  `CVE-2026-72713` · CVE record: OpenBMB XAgent · CVSS 8.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [Lightroom Classic | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2026-48441.md)
  `CVE-2026-48441` · CVE record: Adobe Lightroom Classic · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal
- [Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-65680.md)
  `CVE-2026-65680` · CVE record: Microsoft OneDrive for MacOS · CVSS 6.7 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTA4LTExVDE3OjQ1OjA4LjE0MjAwMFoiLCJDVkUtMjAyNi02NTY4MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTA4LTEzVDE0OjUzOjA1LjA1NjAwMFoiLCJDVkUtMjAyNi0xNTk5NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTA4LTEzVDE0OjUzOjA1LjA1NjAwMFoiLCJDVkUtMjAyNi0xNTk5NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.